code: def test_xss_prevention(admin_client):
      xss = "/variable/list/<img%20src=''%20onerror='alert(1);'>"
      resp = admin_client.get(xss, follow_redirects=True)
      check_content_not_in_response(
          "<img src='' onerror='alert(1);'>", resp, resp_code=404
      )
  
imports: from __future__ import annotations
  from io import BytesIO
  from unittest import mock
  import pytest
  from airflow.models import Variable
  from airflow.security import permissions
  from airflow.utils.session import create_session
  from tests.test_utils.api_connexion_utils import create_user
  from tests.test_utils.www import _check_last_log, check_content_in_response, check_content_not_in_response, client_with_login
label_desc: Use image node_id 5 for calling a global function with example usage: test_xss_prevention(admin_client) without return types